Static task
static1
Behavioral task
behavioral1
Sample
QQ����~1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
QQ����~1.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
wu.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
wu.exe
Resource
win10v2004-20221111-en
General
-
Target
c54eeb1e4face659096fa62e634261390b51e0af8b9d26b98e21b406ba979cdd
-
Size
681KB
-
MD5
a46b1329721c0456e748089b98aee8fd
-
SHA1
edf89b5aa07703db3682a318f4388b4409d2bf19
-
SHA256
c54eeb1e4face659096fa62e634261390b51e0af8b9d26b98e21b406ba979cdd
-
SHA512
a9017ad6c6b3623afe1485ca3b9fea5cc23b69f014160ebb98a8b71d9d74c8083a16d077cf64ac4f087382103618e630b220096436e3bfbbc617c86e351db845
-
SSDEEP
12288:PPm+RuT7ZpRc014kR9MW/oiO1GoCjonGaI7Zg4lOMqRi7uJOAj4OXH/9I4aITmAt:nmjG05tTh1aIlkXi5AjP/9uOFJpD
Malware Config
Signatures
Files
-
c54eeb1e4face659096fa62e634261390b51e0af8b9d26b98e21b406ba979cdd.cab
-
QQ����~1.EXE.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
nsp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nsp1 Size: 609KB - Virtual size: 615KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
wu.exe.exe windows x86
858f17deb2d68eb2bf6457599ff5c282
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
lstrcatA
lstrcpyA
MultiByteToWideChar
lstrlenA
CloseHandle
GetFileTime
GetFileAttributesA
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
GetLastError
ExitProcess
WideCharToMultiByte
SetEnvironmentVariableA
GetTempPathA
LocalFileTimeToFileTime
SystemTimeToFileTime
lstrcmpiA
Sleep
ExpandEnvironmentStringsA
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
user32
wsprintfA
shlwapi
SHDeleteKeyA
msvcrt
_itoa
strlen
rand
srand
_ftol
strcpy
_controlfp
??3@YAXPAX@Z
wcscpy
??2@YAPAXI@Z
_except_handler3
strcat
strncat
strchr
memset
memcpy
__CxxFrameHandler
_CxxThrowException
strstr
tolower
_strnicmp
_memicmp
_strlwr
_stricmp
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
Sections
.text Size: 167KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ